A voir également:
- Infecté par marclesaint et autres.
- L'ordinateur de simon a été infecté par un virus répertorié récemment. son anti-virus ne l'a pas détecté. qu'a-t-il pu se passer ? - Forum Jeux vidéo
- L'ordinateur de samantha a été infecté par un virus répertorié récemment. son anti-virus ne l'a pas détecté. qu'a-t-il pu se passer ? - Forum Antivirus
- Infecte par un virus - Forum Virus
- Simon - Forum Cinéma / Télé
- L'ordinateur d'arthur a été infecté par un virus répertorié récemment. son anti-virus ne l'a pas détecté. qu'a-t-il pu se passer ? ✓ - Forum Virus
18 réponses
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
27 sept. 2009 à 20:52
27 sept. 2009 à 20:52
Salut, télécharge ComboFix à cette adresse : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Puis suis les indications de ce tutoriel scrupuleusement : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Poste ensuite le rapport qui se trouve sous C:\Combofix.txt
Puis suis les indications de ce tutoriel scrupuleusement : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Poste ensuite le rapport qui se trouve sous C:\Combofix.txt
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
28 sept. 2009 à 13:09
28 sept. 2009 à 13:09
Ok, fais ceci maintenant :
-----------------------------------
- Télécharge OTMoveIt (de Old_Timer) https://www.luanagames.com/index.fr.html sur ton Bureau.
- Double-clique sur OTMoveIt.exe
- Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
- Copie le texte en gras ci dessous et colle le dans le cadre de gauche de OTMoveIt nommé Paste List of Files/Folders to be moved
:processes
explorer.exe
windo.exe
myapp.exe
wuauc1t.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MARCLESAINT"=-
"DRIVESYS"=-
"DRIVESYS1"=-
:files
C:\WINDOWS\system32\wuauc1t.exe
C:\Windows\System32\bycool1\windo.exe
C:\Windows\System32\bycool\winacces.exe
C:\WINDOWS\MARCLESAINT.vbs
:commands
[emptytemp]
[purity]
[start explorer]
- Clique sur MoveIt! pour lancer la suppression.
- Si OTMoveIt propose de redémarrer ton PC, accepte.
- Lorsque un résultat apparaît dans le cadre Results, clique sur Exit.
- Dans ta future réponse, envoie le rapport de OTMoveIt situé sur C:\_OTMoveIt\MovedFiles
-----------------------------------
Malwarebyte's anti-malware ----->
[x] Télécharge Malwarebyte's anti-malware (MBAM) à cette adresse : http://www.malwarebytes.org/mbam/program/mbam-setup.exe
[x] Installe le
[x] Coche bien tout les éléments trouvés et supprime les !
[x] Un tutoriel pour son utilisation est disponible ici : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
[x] Suis les indications données sur le lien précédent puis copie/colle le rapport généré dans ton prochain message
-----------------------------------
- Télécharge OTMoveIt (de Old_Timer) https://www.luanagames.com/index.fr.html sur ton Bureau.
- Double-clique sur OTMoveIt.exe
- Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
- Copie le texte en gras ci dessous et colle le dans le cadre de gauche de OTMoveIt nommé Paste List of Files/Folders to be moved
:processes
explorer.exe
windo.exe
myapp.exe
wuauc1t.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MARCLESAINT"=-
"DRIVESYS"=-
"DRIVESYS1"=-
:files
C:\WINDOWS\system32\wuauc1t.exe
C:\Windows\System32\bycool1\windo.exe
C:\Windows\System32\bycool\winacces.exe
C:\WINDOWS\MARCLESAINT.vbs
:commands
[emptytemp]
[purity]
[start explorer]
- Clique sur MoveIt! pour lancer la suppression.
- Si OTMoveIt propose de redémarrer ton PC, accepte.
- Lorsque un résultat apparaît dans le cadre Results, clique sur Exit.
- Dans ta future réponse, envoie le rapport de OTMoveIt situé sur C:\_OTMoveIt\MovedFiles
-----------------------------------
Malwarebyte's anti-malware ----->
[x] Télécharge Malwarebyte's anti-malware (MBAM) à cette adresse : http://www.malwarebytes.org/mbam/program/mbam-setup.exe
[x] Installe le
[x] Coche bien tout les éléments trouvés et supprime les !
[x] Un tutoriel pour son utilisation est disponible ici : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
[x] Suis les indications données sur le lien précédent puis copie/colle le rapport généré dans ton prochain message
d'accord
ben voici le premier log de OTmovelt
je te colle celui de malwarebyte à la suite : merci encore
========== PROCESSES ==========
Process explorer.exe killed successfully.
Unable to kill process: windo.exe
Unable to kill process: myapp.exe
Unable to kill process: wuauc1t.exe
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
========== FILES ==========
File/Folder C:\WINDOWS\system32\wuauc1t.exe not found.
File/Folder C:\Windows\System32\bycool1\windo.exe not found.
File/Folder C:\Windows\System32\bycool\winacces.exe not found.
File/Folder C:\WINDOWS\MARCLESAINT.vbs not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\~DFD8AA.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\cch~5e986ebfb888.htp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\cch~5e986eda0548.htp scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 09282009_181847
Files moved on Reboot...
C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\~DFD8AA.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\cch~5e986ebfb888.htp not found!
File C:\WINDOWS\temp\cch~5e986eda0548.htp not found!
:::::::::::::::::::::::::::::::::::
ben voici le premier log de OTmovelt
je te colle celui de malwarebyte à la suite : merci encore
========== PROCESSES ==========
Process explorer.exe killed successfully.
Unable to kill process: windo.exe
Unable to kill process: myapp.exe
Unable to kill process: wuauc1t.exe
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
========== FILES ==========
File/Folder C:\WINDOWS\system32\wuauc1t.exe not found.
File/Folder C:\Windows\System32\bycool1\windo.exe not found.
File/Folder C:\Windows\System32\bycool\winacces.exe not found.
File/Folder C:\WINDOWS\MARCLESAINT.vbs not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\~DFD8AA.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\cch~5e986ebfb888.htp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\cch~5e986eda0548.htp scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 09282009_181847
Files moved on Reboot...
C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\~DFD8AA.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\cch~5e986ebfb888.htp not found!
File C:\WINDOWS\temp\cch~5e986eda0548.htp not found!
:::::::::::::::::::::::::::::::::::
slt!!!
voici le log de malwarebytes
::::::::::::::::::::::::::::::::::
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2868
Windows 5.1.2600 Service Pack 2 (Safe Mode)
28/09/2009 19:02:27
mbam-log-2009-09-28 (19-02-27).txt
Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|)
Eléments examinés: 130641
Temps écoulé: 11 minute(s), 37 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::
merci encoe , la machine respire dejà mieux!
voici le log de malwarebytes
::::::::::::::::::::::::::::::::::
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2868
Windows 5.1.2600 Service Pack 2 (Safe Mode)
28/09/2009 19:02:27
mbam-log-2009-09-28 (19-02-27).txt
Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|)
Eléments examinés: 130641
Temps écoulé: 11 minute(s), 37 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::
merci encoe , la machine respire dejà mieux!
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
28 sept. 2009 à 21:10
28 sept. 2009 à 21:10
USBfix ------>
[x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe
[x] Un tutoriel est disponible ici : https://www.malekal.com/usbfix-supprimer-virus-usb/
[x] Installe le
[x] Branche tout tes médias amovibles ( clés USB, DD externe )
[x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )
[x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.
[x] Au menu principal, choisi l'option 1
[x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
[x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe
[x] Un tutoriel est disponible ici : https://www.malekal.com/usbfix-supprimer-virus-usb/
[x] Installe le
[x] Branche tout tes médias amovibles ( clés USB, DD externe )
[x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )
[x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.
[x] Au menu principal, choisi l'option 1
[x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
bon apparement usbfix n'est pas telechargeable actu, mais je dois l'avoir sur une de mes sauvegarde, me reste plus qu'a trouver!
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
29 sept. 2009 à 17:21
29 sept. 2009 à 17:21
Des nouvelles concernant USBfix ?
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
1 oct. 2009 à 16:52
1 oct. 2009 à 16:52
Fais ceci :
[x] Lance hijackthis ( C:\Program Files\Trend Micro\Hijackthis.exe )
[x] Clique sur " None of the above, just start the program " puis sur " Scan "
[x] Coche les lignes en gras ci dessous :
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
O4 - HKLM\..\Run: [DRIVESYS1] C:\Windows\System32\bycool1\windo.exe
O4 - HKLM\..\Run: [DRIVESYS] C:\Windows\System32\bycool\winacces.exe
O4 - HKLM\..\Run: [MARCLESAINT] C:\WINDOWS\MARCLESAINT.vbs
[x] Clique ensuite sur " Fix checked "
-----------------
Trojan Remover ---->
[x] Télécharge Trojan Remover à cette adresse : http://dl.commentcamarche.net/www.commentcamarche.net/download/files/trjsetup681.exe
[x] Lance l'installation, coche " Créer un raccourci sur le bureau "
[x] A la fin de l'installation, laisse coché " Vérifier les MaJ " puis clique sur " Terminer "
[x] Clique ensuite sur " Update " , puis sur " Close " à la fin de la MaJ
[x] Lance Trojan Remover qui se trouve sur ton bureau, puis clique sur " Continue "
[x] Clique ensuite sur " Scan " et laisse le logiciel scanner ton PC
[x] A la fin du scan, supprime les trojans détectés.
[x] Clique enfin sur " File " puis " View logfile "
[x] Créer un nouveau document texte " Rapport.txt " et copie/colle le contenu du rapport de TrojanRemover dedans
[x] Enregistre le sur ton bureau
[x] Va ensuite sur ce site : http://www.cijoint.fr/
[x] Clique sur " Parcourir " et séléctionne le fichier Rapport.txt ( sur ton bureau )
[x] Clique ensuite sur " Cliquez ici pour déposer le fichier "
[x] Copie le lien qui s'affichera dans ton prochain post.
[x] Lance hijackthis ( C:\Program Files\Trend Micro\Hijackthis.exe )
[x] Clique sur " None of the above, just start the program " puis sur " Scan "
[x] Coche les lignes en gras ci dessous :
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
O4 - HKLM\..\Run: [DRIVESYS1] C:\Windows\System32\bycool1\windo.exe
O4 - HKLM\..\Run: [DRIVESYS] C:\Windows\System32\bycool\winacces.exe
O4 - HKLM\..\Run: [MARCLESAINT] C:\WINDOWS\MARCLESAINT.vbs
[x] Clique ensuite sur " Fix checked "
-----------------
Trojan Remover ---->
[x] Télécharge Trojan Remover à cette adresse : http://dl.commentcamarche.net/www.commentcamarche.net/download/files/trjsetup681.exe
[x] Lance l'installation, coche " Créer un raccourci sur le bureau "
[x] A la fin de l'installation, laisse coché " Vérifier les MaJ " puis clique sur " Terminer "
[x] Clique ensuite sur " Update " , puis sur " Close " à la fin de la MaJ
[x] Lance Trojan Remover qui se trouve sur ton bureau, puis clique sur " Continue "
[x] Clique ensuite sur " Scan " et laisse le logiciel scanner ton PC
[x] A la fin du scan, supprime les trojans détectés.
[x] Clique enfin sur " File " puis " View logfile "
[x] Créer un nouveau document texte " Rapport.txt " et copie/colle le contenu du rapport de TrojanRemover dedans
[x] Enregistre le sur ton bureau
[x] Va ensuite sur ce site : http://www.cijoint.fr/
[x] Clique sur " Parcourir " et séléctionne le fichier Rapport.txt ( sur ton bureau )
[x] Clique ensuite sur " Cliquez ici pour déposer le fichier "
[x] Copie le lien qui s'affichera dans ton prochain post.
slt!
je n'ai pas ces lignes
voici le nouveau lo de hijack
::::::::::::::::::::::::::::::::
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:55:10, on 01/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pr DONGUI\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ci/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BDARemote.lnk = C:\Program Files\USB TV\EM28XX\BDARemote.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/MaConfig_3_5_3_0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A}: NameServer = 213.136.96.2 213.136.96.37
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
je n'ai pas ces lignes
voici le nouveau lo de hijack
::::::::::::::::::::::::::::::::
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:55:10, on 01/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pr DONGUI\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ci/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BDARemote.lnk = C:\Program Files\USB TV\EM28XX\BDARemote.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/MaConfig_3_5_3_0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A}: NameServer = 213.136.96.2 213.136.96.37
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
1 oct. 2009 à 20:10
1 oct. 2009 à 20:10
Le rapport de trojan remover ?
slt
log de T-R
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.0.2586. For information, email support@simplysup.com
[Unregistered version]
Scan started at: 18:26:27 03 oct. 2009
Using Database v7370
Operating System: Windows XP Professional (SP2) [Build: 5.1.2600]
File System: NTFS
UserData directory: C:\Documents and Settings\Pr DONGUI\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Documents and Settings\All Users\Application Data\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Documents and Settings\Pr DONGUI\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges
************************************************************
************************************************************
18:26:27: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
18:26:28: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [Explorer.exe]
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1036288 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\WINDOWS\system32\userinit.exe,]
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
Key value: [logonui.exe]
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: AVP
Value Data: "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
208616 bytes
Created: 11/11/2008 19:59
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
--------------------
Value Name: Home Theater SchSvr
Value Data: "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
106496 bytes
Created: 28/09/2009 03:37
Modified: 20/10/2005 06:10
Company: InterVideo Inc.
--------------------
Value Name: WINREMOTE
Value Data: "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
262144 bytes
Created: 28/09/2009 03:38
Modified: 20/10/2005 05:02
Company: InterVideo Inc.
--------------------
Value Name: StartCCC
Value Data: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
61440 bytes
Created: 21/07/2009 11:00
Modified: 21/07/2009 11:00
Company: Advanced Micro Devices, Inc.
--------------------
Value Name: HP Software Update
Value Data: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
49152 bytes
Created: 11/05/2005 23:12
Modified: 11/05/2005 23:12
Company: Hewlett-Packard Co.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
35696 bytes
Created: 27/02/2009 17:10
Modified: 27/02/2009 17:10
Company: Adobe Systems Incorporated
--------------------
Value Name: Malwarebytes Anti-Malware (reboot)
Value Data: "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
1312080 bytes
Created: 28/09/2009 18:38
Modified: 10/09/2009 14:53
Company: Malwarebytes Corporation
--------------------
Value Name: AGRSMMSG
Value Data: AGRSMMSG.exe
C:\WINDOWS\AGRSMMSG.exe
88363 bytes
Created: 29/06/2004 09:06
Modified: 29/06/2004 09:06
Company: Agere Systems
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1067912 bytes
Created: 03/10/2009 18:19
Modified: 03/08/2009 14:36
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
************************************************************
18:26:30: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
************************************************************
18:26:30: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
18:26:31: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.
************************************************************
18:26:31: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
************************************************************
18:26:31: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: srservice
Path: %SystemRoot%\system32\srsvc.dll
C:\WINDOWS\system32\srsvc.dll
171008 bytes
Created: 27/09/2009 20:46
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
Key: wuauserv
Path: C1\WINDOWS\system32\wuauserv.dll
C1\WINDOWS\system32\wuauserv.dll - [file not found to scan]
--------------------
************************************************************
18:26:32: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 3xHybrid
ImagePath: system32\DRIVERS\3xHybrid.sys
C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
2825088 bytes
Created: 14/02/2006 18:07
Modified: 14/02/2006 18:07
Company: ASUSTek
----------
Key: adiusbaw
ImagePath: system32\DRIVERS\adiusbaw.sys
C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
118552 bytes
Created: 03/10/2009 17:36
Modified: 07/02/2007 16:50
Company: Analog Devices Inc.
----------
Key: AVP
ImagePath: "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
208616 bytes
Created: 11/11/2008 19:59
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
----------
Key: catchme
ImagePath: \??\C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\catchme.sys - this file is globally excluded
----------
Key: driverhardwarev2
ImagePath: \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
14336 bytes
Created: 23/09/2009 14:53
Modified: 23/09/2009 14:53
Company: CybelSoft
----------
Key: ELOADER
ImagePath: System32\Drivers\adildr.sys
C:\WINDOWS\System32\Drivers\adildr.sys
56088 bytes
Created: 03/10/2009 17:36
Modified: 07/02/2007 16:50
Company: Analog Deivces
----------
Key: GMSIPCI
ImagePath: \??\J:\INSTALL\GMSIPCI.SYS - this file is globally excluded
----------
Key: HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
-R- 51120 bytes
Created: 28/09/2009 10:48
Modified: 08/03/2005 04:43
Company: HP
----------
Key: HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
-R- 16496 bytes
Created: 28/09/2009 10:48
Modified: 08/03/2005 04:43
Company: HP
----------
Key: HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
-R- 21744 bytes
Created: 28/09/2009 10:47
Modified: 08/03/2005 04:43
Company: HP
----------
Key: ImapiService
ImagePath: %systemroot%\system32\imapi.exe
C:\WINDOWS\system32\imapi.exe
150016 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
Key: klbg
ImagePath: system32\drivers\klbg.sys
C:\WINDOWS\system32\drivers\klbg.sys
33808 bytes
Created: 29/01/2008 17:29
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
----------
Key: KLFLTDEV
ImagePath: system32\DRIVERS\klfltdev.sys
C:\WINDOWS\system32\DRIVERS\klfltdev.sys
26640 bytes
Created: 13/03/2008 18:02
Modified: 13/03/2008 18:02
Company: Kaspersky Lab
----------
Key: maconfservice
ImagePath: "C:\Program Files\ma-config.com\maconfservice.exe"
C:\Program Files\ma-config.com\maconfservice.exe
238960 bytes
Created: 23/09/2009 14:50
Modified: 23/09/2009 14:50
Company: CybelSoft
----------
Key: odserv
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE
441136 bytes
Created: 26/10/2006 19:49
Modified: 26/10/2006 19:49
Company: Microsoft Corporation
----------
Key: ose
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
145184 bytes
Created: 26/10/2006 14:03
Modified: 26/10/2006 14:03
Company: Microsoft Corporation
----------
Key: Pml Driver HPZ12
ImagePath: C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\HPZipm12.exe
73728 bytes
Created: 28/09/2009 10:39
Modified: 09/08/2007 07:27
Company: HP
----------
Key: Secdrv
ImagePath: system32\DRIVERS\secdrv.sys
C:\WINDOWS\system32\DRIVERS\secdrv.sys
27440 bytes
Created: 17/07/2004 11:36
Modified: 17/07/2004 11:36
Company: [no info]
----------
Key: SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{5696AE86-18E0-4390-9E07-61C06B3CE898}
C:\WINDOWS\system32\dllhost.exe
5120 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
************************************************************
18:26:35: Scanning -----VXD ENTRIES-----
************************************************************
18:26:35: Scanning ----- WINLOGON\NOTIFY DLLS -----
************************************************************
18:26:36: Scanning ----- CONTEXTMENUHANDLERS -----
Key: Kaspersky Anti-Virus
CLSID: {dd230880-495a-11d1-b064-008048ec2fc5}
Path: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll
39688 bytes
Created: 11/11/2008 20:00
Modified: 11/11/2008 20:00
Company: Kaspersky Lab
----------
Key: ShellExtension
CLSID: [empty]
----------
************************************************************
18:26:36: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
378200 bytes
Created: 27/02/2009 12:16
Modified: 27/02/2009 12:16
Company: Adobe Systems, Inc.
----------
************************************************************
18:26:36: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}
BHO: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
62728 bytes
Created: 11/11/2008 19:59
Modified: 11/11/2008 19:59
Company: Kaspersky Lab
----------
Key: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
160496 bytes
Created: 28/07/2008 10:47
Modified: 28/07/2008 10:47
Company: Yahoo! Inc
----------
************************************************************
18:26:37: Scanning ----- SHELLSERVICEOBJECTS -----
Key: SysTray
CLSID: {35CEC8A3-2BE6-11D2-8773-92E220524153}
Path: %systemroot%\system32\stobject.dll
C:\WINDOWS\system32\stobject.dll
122368 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
************************************************************
18:26:37: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
************************************************************
18:26:37: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.
************************************************************
18:26:37: Scanning ----- APPINIT_DLLS -----
No APPINIT_DLLS value found to check
************************************************************
18:26:37: Scanning ----- SECURITY PROVIDER DLLS -----
************************************************************
18:26:37: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
BDARemote.lnk - links to C:\PROGRA~1\USBTV~1\EM28XX\BDAREM~1.EXE
C:\PROGRA~1\USBTV~1\EM28XX\BDAREM~1.EXE
81997 bytes
Created: 27/09/2009 23:00
Modified: 26/06/2007 12:22
Company: [no info]
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 27/09/2002 19:36
Modified: 27/09/2009 20:49
Company: [no info]
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini - no action taken on this file
--------------------
DSLMON.lnk - links to C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
1205840 bytes
Created: 03/10/2009 17:36
Modified: 13/02/2007 16:20
Company:
--------------------
************************************************************
No User Startup Groups were located to check
************************************************************
18:26:38: Scanning ----- SCHEDULED TASKS -----
No Scheduled Tasks found to scan
************************************************************
18:26:38: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
************************************************************
18:26:38: Scanning ----- DEVICE DRIVER ENTRIES -----
************************************************************
18:26:38: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 28/09/2009 02:18
Modified: 28/09/2009 02:19
Company: [no info]
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 28/09/2009 02:18
Modified: 28/09/2009 02:19
Company: [no info]
----------
DNS Server information:
Interface:
NameServers: 213.136.96.2 213.136.96.37
Checks for rogue DNS NameServers completed
----------
Additional checks completed
************************************************************
18:26:39: Scanning ----- RUNNING PROCESSES -----
C:\WINDOWS\System32\smss.exe
50688 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\csrss.exe
6144 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\winlogon.exe
506368 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\services.exe
111104 bytes
Created: 19/08/2004 16:10
Modified: 09/02/2009 10:08
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\lsass.exe
13312 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
602112 bytes
Created: 22/03/2006 03:48
Modified: 21/07/2009 15:42
Company: ATI Technologies Inc.
--------------------
C:\WINDOWS\system32\svchost.exe
14336 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\Ati2evxx.exe - file already scanned
--------------------
C:\WINDOWS\system32\spoolsv.exe
57856 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
--------------------
C:\WINDOWS\system32\HPZipm12.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe - file already scanned
--------------------
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe - file already scanned
--------------------
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
49152 bytes
Created: 18/12/2008 14:32
Modified: 18/12/2008 14:32
Company: Advanced Micro Devices Inc.
--------------------
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe - file already scanned
--------------------
C:\WINDOWS\AGRSMMSG.exe - file already scanned
--------------------
C:\Program Files\USB TV\EM28XX\BDARemote.exe
81997 bytes
Created: 27/09/2009 23:00
Modified: 26/06/2007 12:22
Company: [no info]
--------------------
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
1205840 bytes
Created: 03/10/2009 17:36
Modified: 13/02/2007 16:20
Company:
--------------------
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
49152 bytes
Created: 18/12/2008 13:19
Modified: 18/12/2008 13:19
Company: ATI Technologies Inc.
--------------------
C:\Program Files\Mozilla Firefox\firefox.exe
908280 bytes
Created: 29/09/2009 12:56
Modified: 24/08/2009 20:19
Company: Mozilla Corporation
--------------------
C:\WINDOWS\system32\wbem\wmiprvse.exe
227840 bytes
Created: 27/09/2009 20:44
Modified: 06/02/2009 16:39
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\wbem\wmiprvse.exe - file already scanned
--------------------
C:\Documents and Settings\Pr DONGUI\Application Data\Simply Super Software\Trojan Remover\mnw2A.exe
FileSize: 3036024
[This is a Trojan Remover component]
--------------------
************************************************************
18:26:44: Checking HOSTS file
No malicious entries were found in the HOSTS file
************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 18:26:44 03 oct. 2009
Total Scan time: 00:00:16
************************************************************
log de T-R
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.0.2586. For information, email support@simplysup.com
[Unregistered version]
Scan started at: 18:26:27 03 oct. 2009
Using Database v7370
Operating System: Windows XP Professional (SP2) [Build: 5.1.2600]
File System: NTFS
UserData directory: C:\Documents and Settings\Pr DONGUI\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Documents and Settings\All Users\Application Data\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Documents and Settings\Pr DONGUI\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges
************************************************************
************************************************************
18:26:27: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
18:26:28: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [Explorer.exe]
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1036288 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\WINDOWS\system32\userinit.exe,]
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
Key value: [logonui.exe]
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: AVP
Value Data: "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
208616 bytes
Created: 11/11/2008 19:59
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
--------------------
Value Name: Home Theater SchSvr
Value Data: "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
106496 bytes
Created: 28/09/2009 03:37
Modified: 20/10/2005 06:10
Company: InterVideo Inc.
--------------------
Value Name: WINREMOTE
Value Data: "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
262144 bytes
Created: 28/09/2009 03:38
Modified: 20/10/2005 05:02
Company: InterVideo Inc.
--------------------
Value Name: StartCCC
Value Data: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
61440 bytes
Created: 21/07/2009 11:00
Modified: 21/07/2009 11:00
Company: Advanced Micro Devices, Inc.
--------------------
Value Name: HP Software Update
Value Data: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
49152 bytes
Created: 11/05/2005 23:12
Modified: 11/05/2005 23:12
Company: Hewlett-Packard Co.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
35696 bytes
Created: 27/02/2009 17:10
Modified: 27/02/2009 17:10
Company: Adobe Systems Incorporated
--------------------
Value Name: Malwarebytes Anti-Malware (reboot)
Value Data: "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
1312080 bytes
Created: 28/09/2009 18:38
Modified: 10/09/2009 14:53
Company: Malwarebytes Corporation
--------------------
Value Name: AGRSMMSG
Value Data: AGRSMMSG.exe
C:\WINDOWS\AGRSMMSG.exe
88363 bytes
Created: 29/06/2004 09:06
Modified: 29/06/2004 09:06
Company: Agere Systems
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1067912 bytes
Created: 03/10/2009 18:19
Modified: 03/08/2009 14:36
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
************************************************************
18:26:30: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
************************************************************
18:26:30: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
18:26:31: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.
************************************************************
18:26:31: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
************************************************************
18:26:31: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: srservice
Path: %SystemRoot%\system32\srsvc.dll
C:\WINDOWS\system32\srsvc.dll
171008 bytes
Created: 27/09/2009 20:46
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
Key: wuauserv
Path: C1\WINDOWS\system32\wuauserv.dll
C1\WINDOWS\system32\wuauserv.dll - [file not found to scan]
--------------------
************************************************************
18:26:32: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 3xHybrid
ImagePath: system32\DRIVERS\3xHybrid.sys
C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
2825088 bytes
Created: 14/02/2006 18:07
Modified: 14/02/2006 18:07
Company: ASUSTek
----------
Key: adiusbaw
ImagePath: system32\DRIVERS\adiusbaw.sys
C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
118552 bytes
Created: 03/10/2009 17:36
Modified: 07/02/2007 16:50
Company: Analog Devices Inc.
----------
Key: AVP
ImagePath: "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
208616 bytes
Created: 11/11/2008 19:59
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
----------
Key: catchme
ImagePath: \??\C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\catchme.sys - this file is globally excluded
----------
Key: driverhardwarev2
ImagePath: \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
14336 bytes
Created: 23/09/2009 14:53
Modified: 23/09/2009 14:53
Company: CybelSoft
----------
Key: ELOADER
ImagePath: System32\Drivers\adildr.sys
C:\WINDOWS\System32\Drivers\adildr.sys
56088 bytes
Created: 03/10/2009 17:36
Modified: 07/02/2007 16:50
Company: Analog Deivces
----------
Key: GMSIPCI
ImagePath: \??\J:\INSTALL\GMSIPCI.SYS - this file is globally excluded
----------
Key: HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
-R- 51120 bytes
Created: 28/09/2009 10:48
Modified: 08/03/2005 04:43
Company: HP
----------
Key: HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
-R- 16496 bytes
Created: 28/09/2009 10:48
Modified: 08/03/2005 04:43
Company: HP
----------
Key: HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
-R- 21744 bytes
Created: 28/09/2009 10:47
Modified: 08/03/2005 04:43
Company: HP
----------
Key: ImapiService
ImagePath: %systemroot%\system32\imapi.exe
C:\WINDOWS\system32\imapi.exe
150016 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
Key: klbg
ImagePath: system32\drivers\klbg.sys
C:\WINDOWS\system32\drivers\klbg.sys
33808 bytes
Created: 29/01/2008 17:29
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
----------
Key: KLFLTDEV
ImagePath: system32\DRIVERS\klfltdev.sys
C:\WINDOWS\system32\DRIVERS\klfltdev.sys
26640 bytes
Created: 13/03/2008 18:02
Modified: 13/03/2008 18:02
Company: Kaspersky Lab
----------
Key: maconfservice
ImagePath: "C:\Program Files\ma-config.com\maconfservice.exe"
C:\Program Files\ma-config.com\maconfservice.exe
238960 bytes
Created: 23/09/2009 14:50
Modified: 23/09/2009 14:50
Company: CybelSoft
----------
Key: odserv
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE
441136 bytes
Created: 26/10/2006 19:49
Modified: 26/10/2006 19:49
Company: Microsoft Corporation
----------
Key: ose
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
145184 bytes
Created: 26/10/2006 14:03
Modified: 26/10/2006 14:03
Company: Microsoft Corporation
----------
Key: Pml Driver HPZ12
ImagePath: C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\HPZipm12.exe
73728 bytes
Created: 28/09/2009 10:39
Modified: 09/08/2007 07:27
Company: HP
----------
Key: Secdrv
ImagePath: system32\DRIVERS\secdrv.sys
C:\WINDOWS\system32\DRIVERS\secdrv.sys
27440 bytes
Created: 17/07/2004 11:36
Modified: 17/07/2004 11:36
Company: [no info]
----------
Key: SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{5696AE86-18E0-4390-9E07-61C06B3CE898}
C:\WINDOWS\system32\dllhost.exe
5120 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
************************************************************
18:26:35: Scanning -----VXD ENTRIES-----
************************************************************
18:26:35: Scanning ----- WINLOGON\NOTIFY DLLS -----
************************************************************
18:26:36: Scanning ----- CONTEXTMENUHANDLERS -----
Key: Kaspersky Anti-Virus
CLSID: {dd230880-495a-11d1-b064-008048ec2fc5}
Path: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll
39688 bytes
Created: 11/11/2008 20:00
Modified: 11/11/2008 20:00
Company: Kaspersky Lab
----------
Key: ShellExtension
CLSID: [empty]
----------
************************************************************
18:26:36: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
378200 bytes
Created: 27/02/2009 12:16
Modified: 27/02/2009 12:16
Company: Adobe Systems, Inc.
----------
************************************************************
18:26:36: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}
BHO: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
62728 bytes
Created: 11/11/2008 19:59
Modified: 11/11/2008 19:59
Company: Kaspersky Lab
----------
Key: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
160496 bytes
Created: 28/07/2008 10:47
Modified: 28/07/2008 10:47
Company: Yahoo! Inc
----------
************************************************************
18:26:37: Scanning ----- SHELLSERVICEOBJECTS -----
Key: SysTray
CLSID: {35CEC8A3-2BE6-11D2-8773-92E220524153}
Path: %systemroot%\system32\stobject.dll
C:\WINDOWS\system32\stobject.dll
122368 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
************************************************************
18:26:37: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
************************************************************
18:26:37: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.
************************************************************
18:26:37: Scanning ----- APPINIT_DLLS -----
No APPINIT_DLLS value found to check
************************************************************
18:26:37: Scanning ----- SECURITY PROVIDER DLLS -----
************************************************************
18:26:37: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
BDARemote.lnk - links to C:\PROGRA~1\USBTV~1\EM28XX\BDAREM~1.EXE
C:\PROGRA~1\USBTV~1\EM28XX\BDAREM~1.EXE
81997 bytes
Created: 27/09/2009 23:00
Modified: 26/06/2007 12:22
Company: [no info]
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 27/09/2002 19:36
Modified: 27/09/2009 20:49
Company: [no info]
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini - no action taken on this file
--------------------
DSLMON.lnk - links to C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
1205840 bytes
Created: 03/10/2009 17:36
Modified: 13/02/2007 16:20
Company:
--------------------
************************************************************
No User Startup Groups were located to check
************************************************************
18:26:38: Scanning ----- SCHEDULED TASKS -----
No Scheduled Tasks found to scan
************************************************************
18:26:38: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
************************************************************
18:26:38: Scanning ----- DEVICE DRIVER ENTRIES -----
************************************************************
18:26:38: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 28/09/2009 02:18
Modified: 28/09/2009 02:19
Company: [no info]
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 28/09/2009 02:18
Modified: 28/09/2009 02:19
Company: [no info]
----------
DNS Server information:
Interface:
NameServers: 213.136.96.2 213.136.96.37
Checks for rogue DNS NameServers completed
----------
Additional checks completed
************************************************************
18:26:39: Scanning ----- RUNNING PROCESSES -----
C:\WINDOWS\System32\smss.exe
50688 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\csrss.exe
6144 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\winlogon.exe
506368 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\services.exe
111104 bytes
Created: 19/08/2004 16:10
Modified: 09/02/2009 10:08
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\lsass.exe
13312 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
602112 bytes
Created: 22/03/2006 03:48
Modified: 21/07/2009 15:42
Company: ATI Technologies Inc.
--------------------
C:\WINDOWS\system32\svchost.exe
14336 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\Ati2evxx.exe - file already scanned
--------------------
C:\WINDOWS\system32\spoolsv.exe
57856 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
--------------------
C:\WINDOWS\system32\HPZipm12.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe - file already scanned
--------------------
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe - file already scanned
--------------------
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
49152 bytes
Created: 18/12/2008 14:32
Modified: 18/12/2008 14:32
Company: Advanced Micro Devices Inc.
--------------------
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe - file already scanned
--------------------
C:\WINDOWS\AGRSMMSG.exe - file already scanned
--------------------
C:\Program Files\USB TV\EM28XX\BDARemote.exe
81997 bytes
Created: 27/09/2009 23:00
Modified: 26/06/2007 12:22
Company: [no info]
--------------------
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
1205840 bytes
Created: 03/10/2009 17:36
Modified: 13/02/2007 16:20
Company:
--------------------
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
49152 bytes
Created: 18/12/2008 13:19
Modified: 18/12/2008 13:19
Company: ATI Technologies Inc.
--------------------
C:\Program Files\Mozilla Firefox\firefox.exe
908280 bytes
Created: 29/09/2009 12:56
Modified: 24/08/2009 20:19
Company: Mozilla Corporation
--------------------
C:\WINDOWS\system32\wbem\wmiprvse.exe
227840 bytes
Created: 27/09/2009 20:44
Modified: 06/02/2009 16:39
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\wbem\wmiprvse.exe - file already scanned
--------------------
C:\Documents and Settings\Pr DONGUI\Application Data\Simply Super Software\Trojan Remover\mnw2A.exe
FileSize: 3036024
[This is a Trojan Remover component]
--------------------
************************************************************
18:26:44: Checking HOSTS file
No malicious entries were found in the HOSTS file
************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 18:26:44 03 oct. 2009
Total Scan time: 00:00:16
************************************************************
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
3 oct. 2009 à 20:50
3 oct. 2009 à 20:50
Réessaye USBfix maintenant.
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
4 oct. 2009 à 16:02
4 oct. 2009 à 16:02
-+-+-+-> USBfix <-+-+-+-
[x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe
[x] Un tutoriel est disponible ici : https://www.malekal.com/usbfix-supprimer-virus-usb/
[x] Installe le
[x] Branche tout tes médias amovibles ( clés USB, DD externe )
[x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )
[x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.
[x] Au menu principal, choisi l'option 1
[x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
[x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe
[x] Un tutoriel est disponible ici : https://www.malekal.com/usbfix-supprimer-virus-usb/
[x] Installe le
[x] Branche tout tes médias amovibles ( clés USB, DD externe )
[x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )
[x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.
[x] Au menu principal, choisi l'option 1
[x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
7 oct. 2009 à 17:13
7 oct. 2009 à 17:13
Il faut que tu passes USBfix, tu as une infection usb..
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
7 oct. 2009 à 17:18
7 oct. 2009 à 17:18
Essaie de le télécharger ici : http://usbfix.softonic.fr/
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
7 oct. 2009 à 17:26
7 oct. 2009 à 17:26
Ca te fais quoi comme message d'erreur ?
oui je recois un message d'erreur quelque soit le site ou je vais le telecharger, mais jai pas ce pb avec les autres telechargements.
wi
C:\Documents and Settings\Pr DONGUI\Mes documents\Téléchargements\UsbFix.exe ne pourra être enregistré car le fichier source ne peut être lu.
Réessayez plus tard ou contactez l'administrateur du serveur.
C:\Documents and Settings\Pr DONGUI\Mes documents\Téléchargements\UsbFix.exe ne pourra être enregistré car le fichier source ne peut être lu.
Réessayez plus tard ou contactez l'administrateur du serveur.
Xplode
Messages postés
8820
Date d'inscription
vendredi 21 août 2009
Statut
Contributeur sécurité
Dernière intervention
2 juillet 2015
726
7 oct. 2009 à 17:43
7 oct. 2009 à 17:43
Peux-tu refaire un rapport RSIT ?
2eme log
info.txt logfile of random's system information tool 1.06 2009-10-07 15:51:38
======Uninstall list======
-->"C:\Program Files\InstallShield Installation Information\{1A91D1FA-B9B3-4556-9878-5C61059A19B2}\setup.exe" REMOVEALL
-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{89AD2814-AFA2-46AF-AE53-C27196D9FBE6}\setup.exe" REMOVEALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAA4CCCE-78DB-47B0-A651-68270D838BD4}\setup.exe" REMOVEALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Agere Systems PCI Soft Modem-->agrsmdel
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ASUS Hybrid Capture Device-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6FB17451-D5A4-4651-AC17-A6713F7234BA}\Setup.exe" -l0x9
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x575c
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Catalyst Control Center - Branding-->MsiExec.exe /I{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Color LaserJet 2600n-->C:\Program Files\Zenographics\{189F866C-1589-4CFB-B8C4-C2EB5AF38F84}\setup.exe -u "HPCLJKCInstaller.dll=CLJ2600.INF"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP Extended Capabilities 5.3-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Image Zone Express-->MsiExec.exe /X{FE64AE29-0883-4C70-8388-DC026019C900}
HP Imaging Device Functions 5.3-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP Product Detection-->MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Software Update-->MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D}
HP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
InterVideo Home Theater-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F7514465-E5F3-48E9-A952-327DAEF33DE6}\setup.exe" REMOVEALL
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Ma-Config.com-->MsiExec.exe /X{425FFD94-36BD-4933-881B-FE0B9DADF2B7}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958470)-->"C:\WINDOWS\$NtUninstallKB958470$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971032)-->"C:\WINDOWS\$NtUninstallKB971032$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Mozilla Firefox (3.5.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Package de pilotes Windows - Advanced Micro Devices, Inc. (USB28xxBGA) Media (08/31/2007 5.7.0831.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\embda_754491038463AF55DC013DBF40581C2B1BFEE429\embda.inf
Package de pilotes Windows - eMPIA Technology Inc, (emAudio) MEDIA (08/31/2007 5.7.0831.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\emaudio_754491038463AF55DC013DBF40581C2B1BFEE429\emaudio.inf
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -removeonly
SAGEM F@st 800-840-->C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe -runfromtemp -l0x040c -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Sonic Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Outlook 2007 Junk Email Filter (kb973514)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {03B11C77-336F-43B4-9B43-79890BA84504}
USB Video Driver-->C:\Program Files\InstallShield Installation Information\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}\setup.exe -runfromtemp -l0x040c -removeonly
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Support Tools-->MsiExec.exe /I{89B078C4-50B0-453E-BF53-3A7E6A0D85FA}
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
======Security center information======
AV: Kaspersky Internet Security (outdated)
FW: Kaspersky Internet Security
======System event log======
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.
Record Number: 257
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Service de découvertes SSDP est entré dans l'état : en cours d'exécution.
Record Number: 256
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.
Record Number: 255
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.
Record Number: 254
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de découvertes SSDP.
Record Number: 253
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Support Tools;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 3, GenuineIntel
"PROCESSOR_REVISION"=0403
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\
-----------------EOF-----------------
info.txt logfile of random's system information tool 1.06 2009-10-07 15:51:38
======Uninstall list======
-->"C:\Program Files\InstallShield Installation Information\{1A91D1FA-B9B3-4556-9878-5C61059A19B2}\setup.exe" REMOVEALL
-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{89AD2814-AFA2-46AF-AE53-C27196D9FBE6}\setup.exe" REMOVEALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAA4CCCE-78DB-47B0-A651-68270D838BD4}\setup.exe" REMOVEALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Agere Systems PCI Soft Modem-->agrsmdel
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ASUS Hybrid Capture Device-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6FB17451-D5A4-4651-AC17-A6713F7234BA}\Setup.exe" -l0x9
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x575c
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Catalyst Control Center - Branding-->MsiExec.exe /I{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Color LaserJet 2600n-->C:\Program Files\Zenographics\{189F866C-1589-4CFB-B8C4-C2EB5AF38F84}\setup.exe -u "HPCLJKCInstaller.dll=CLJ2600.INF"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP Extended Capabilities 5.3-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Image Zone Express-->MsiExec.exe /X{FE64AE29-0883-4C70-8388-DC026019C900}
HP Imaging Device Functions 5.3-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP Product Detection-->MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Software Update-->MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D}
HP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
InterVideo Home Theater-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F7514465-E5F3-48E9-A952-327DAEF33DE6}\setup.exe" REMOVEALL
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Ma-Config.com-->MsiExec.exe /X{425FFD94-36BD-4933-881B-FE0B9DADF2B7}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958470)-->"C:\WINDOWS\$NtUninstallKB958470$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971032)-->"C:\WINDOWS\$NtUninstallKB971032$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Mozilla Firefox (3.5.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Package de pilotes Windows - Advanced Micro Devices, Inc. (USB28xxBGA) Media (08/31/2007 5.7.0831.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\embda_754491038463AF55DC013DBF40581C2B1BFEE429\embda.inf
Package de pilotes Windows - eMPIA Technology Inc, (emAudio) MEDIA (08/31/2007 5.7.0831.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\emaudio_754491038463AF55DC013DBF40581C2B1BFEE429\emaudio.inf
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -removeonly
SAGEM F@st 800-840-->C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe -runfromtemp -l0x040c -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Sonic Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Outlook 2007 Junk Email Filter (kb973514)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {03B11C77-336F-43B4-9B43-79890BA84504}
USB Video Driver-->C:\Program Files\InstallShield Installation Information\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}\setup.exe -runfromtemp -l0x040c -removeonly
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Support Tools-->MsiExec.exe /I{89B078C4-50B0-453E-BF53-3A7E6A0D85FA}
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
======Security center information======
AV: Kaspersky Internet Security (outdated)
FW: Kaspersky Internet Security
======System event log======
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.
Record Number: 257
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Service de découvertes SSDP est entré dans l'état : en cours d'exécution.
Record Number: 256
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.
Record Number: 255
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.
Record Number: 254
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:
Computer Name: CFC-035255AA9E8
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de découvertes SSDP.
Record Number: 253
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Support Tools;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 3, GenuineIntel
"PROCESSOR_REVISION"=0403
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\
-----------------EOF-----------------
Logfile of random's system information tool 1.06 (written by random/random)
Run by Pr DONGUI at 2009-10-07 15:50:40
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 132 GB (90%) free of 146 GB
Total RAM: 1023 MB (46% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51:37, on 07/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Pr DONGUI\Mes documents\Téléchargements\RSIT.exe
C:\Program Files\trend micro\Pr DONGUI.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ci/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BDARemote.lnk = C:\Program Files\USB TV\EM28XX\BDARemote.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/MaConfig_3_5_3_0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A}: NameServer = 213.136.96.2 213.136.96.37
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Run by Pr DONGUI at 2009-10-07 15:50:40
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 132 GB (90%) free of 146 GB
Total RAM: 1023 MB (46% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51:37, on 07/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Pr DONGUI\Mes documents\Téléchargements\RSIT.exe
C:\Program Files\trend micro\Pr DONGUI.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ci/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BDARemote.lnk = C:\Program Files\USB TV\EM28XX\BDARemote.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/MaConfig_3_5_3_0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A}: NameServer = 213.136.96.2 213.136.96.37
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
27 sept. 2009 à 21:26
28 sept. 2009 à 07:16
quelques soucis avec ma connexion, bon voici le log de combofix
:::::::::
::::
ComboFix 09-09-25.01 - Pr DONGUI 28/09/2009 2:05.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1023.640 [GMT 0:00]
Lancé depuis: c:\documents and settings\Pr DONGUI\Bureau\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_DAC970NT
-------\Service_dac970nt
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-28 au 2009-09-28 ))))))))))))))))))))))))))))))))))))
.
2009-09-28 01:27 . 2009-09-28 01:27 -------- d-s---w- c:\documents and settings\Pr DONGUI\UserData
2009-09-28 01:12 . 2009-09-28 01:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-09-28 01:12 . 2009-09-28 01:12 -------- d-----w- c:\documents and settings\Pr DONGUI\Application Data\Yahoo!
2009-09-28 01:12 . 2009-09-28 01:14 -------- d-----w- c:\program files\Yahoo!
2009-09-28 01:12 . 2009-09-28 01:14 -------- d-----w- c:\program files\CCleaner
2009-09-28 01:06 . 2006-03-17 15:37 520192 ------w- c:\windows\system32\ati2sgag.exe
2009-09-27 23:31 . 2009-09-27 23:31 -------- d-----w- c:\program files\Microsoft Works
2009-09-27 23:30 . 2009-09-27 23:30 -------- d-----w- c:\program files\MSBuild
2009-09-27 23:27 . 2009-09-27 23:30 -------- d-----w- c:\windows\SHELLNEW
2009-09-27 23:27 . 2009-09-27 23:27 -------- d-----r- C:\MSOCache
2009-09-27 23:09 . 2009-09-27 23:09 12328 ----a-w- c:\documents and settings\Pr DONGUI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-27 23:00 . 2009-09-27 23:00 -------- d-----w- c:\program files\DIFX
2009-09-27 23:00 . 2009-09-27 23:00 -------- dc----w- c:\windows\system32\DRVSTORE
2009-09-27 23:00 . 2009-09-27 23:00 -------- d-----w- c:\program files\USB TV
2009-09-27 22:59 . 2009-09-27 22:59 -------- d-----w- c:\program files\ATI Technologies
2009-09-27 22:58 . 2009-09-28 01:07 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-09-27 22:57 . 2009-09-27 22:57 -------- d-----w- C:\ATI
2009-09-27 22:46 . 2004-08-03 23:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-09-27 22:46 . 2004-08-03 23:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-09-27 22:16 . 2009-09-27 22:16 -------- d-----w- C:\Pilotes-pciv92v4v4l
2009-09-27 21:58 . 2009-09-27 21:57 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2009-09-27 21:58 . 2009-09-27 21:57 130432 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys
2009-09-27 21:58 . 2009-09-27 21:58 -------- d-----w- c:\program files\Realtek
2009-09-27 21:45 . 2009-09-27 21:45 -------- d-----w- c:\program files\ma-config.com
2009-09-27 21:45 . 2009-09-27 21:45 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-09-27 21:22 . 2009-09-27 21:22 -------- d-----w- c:\documents and settings\Pr DONGUI\Local Settings\Application Data\Microsoft Help
2009-09-27 21:22 . 2009-09-27 23:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-28 02:09 . 2009-09-27 20:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-28 02:08 . 2009-09-27 20:57 616480 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-28 02:08 . 2009-09-27 20:57 5896 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-28 02:08 . 2009-09-27 20:57 1584 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-28 02:08 . 2009-09-27 20:57 147488 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-09-28 01:50 . 2009-09-27 20:57 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-09-28 01:50 . 2009-09-27 20:57 107547 ----a-w- c:\windows\system32\drivers\klin.dat
2009-09-28 01:06 . 2009-09-27 20:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-27 23:05 . 2008-01-29 17:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-09-27 22:30 . 2009-09-27 22:30 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-27 22:30 . 2009-09-27 22:30 -------- d--h--w- c:\program files\Zenographics
2009-09-27 21:00 . 2009-09-27 21:00 32 ----a-w- c:\windows\system32\drivers\adidsl.cfg
2009-09-27 20:59 . 2009-09-27 20:59 -------- d-----w- c:\program files\SAGEM
2009-09-27 20:59 . 2009-09-27 20:59 -------- d-----w- c:\documents and settings\Pr DONGUI\Application Data\InstallShield
2009-09-27 20:57 . 2009-09-27 20:57 -------- d-----w- c:\program files\Kaspersky Lab
2009-09-27 20:54 . 2001-09-28 11:00 48616 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-27 20:54 . 2001-09-28 11:00 367658 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-27 20:49 . 2009-09-27 20:49 -------- d-----w- c:\program files\microsoft frontpage
2009-09-27 20:47 . 2009-09-27 20:47 -------- d-----w- c:\program files\Services en ligne
2009-09-27 20:46 . 2009-09-27 20:46 21892 ----a-w- c:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-09-27 208616]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2009-9-27 81997]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-9-27 1205840]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 18:02 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 24592]
S2 ELOADER;General Purpose USB Driver (adildr.sys);c:\windows\system32\drivers\adildr.sys [27/09/2009 21:00 56088]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 14:50 238960]
.
.
------- Examen supplémentaire -------
.
IE: Ajouter à Kaspersky Anti-Bannière - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A} = 213.136.96.2 213.136.96.37
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-28 02:09
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1048)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
.
**************************************************************************
.
Heure de fin: 2009-09-28 2:10 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-28 02:10
Avant-CF: 147 074 240 512 octets libres
Après-CF: 147 203 145 728 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
143
Merci d'avance et à plus